• m 

NDS events cannot be fired in tiiis environment. Violating tiiis behaviour would 
inappropriately identify the true authorship of an event i.e. a user or process should not 
be allowed to change the directory as if the directory did it. The process should be 
identified as the source or author of the event or behavior. 

The present invention nnay be embodied in other specific forms without 
departing from its spirit or essential characteristics. The described embodiments are to 
be considered in all respects only as illustrative and not restrictive. The scope of the 
invention is, therefore, indicated by the appended claims rather than by the foregoing 
description. All changes that come within the meaning and range of equivalency of the 
claims are to be embraced within their scope. 

What is claimed is: 
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^ 1 . In a distributed computer system (DCE) that provides evenj/^lobalizing 

of at least one event at one server in said DCE to other servers within s^d DCE, a 
method of maintaining a record of specific event activity over said DCE comprising: 
storing a global event repository comprising a list of evams and a 
5 corresponding list of servers in order to identi^ which of said servers 

should receive which events; 
storing a local event registry comprising a list of events and a corresponding 

list of local event consumers in ordep^o identify which of said local event 
consumers should receive which j^ents; 
10 identifying specific events within the 1^;^ of events to be monitored for a specific 

purpose; 

monitoring said specific events afe they occur over said DCE; and 
notifying a specific local eveiy consumer of the occurrence of said specific 
events; and 

15 recording a log of event/&ctivity involving only said specific events. 
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2. A method of observing events as recited in claim 1 further comprising 
the step of storing filtering criteria that is used to filter specific events that occur so that 
only notification of events meeting the stored filtering criteria is sent. 

3. Aymethod of observing events as recited in claim 2 wherein said stored 
filtering criteria Specifies at least one event consumer and the filtering criteria 
associated wim the at least one event consumer. 



25 ^. A method of observing events as recited in claim 1 wherein said global 

event registry is accessible to a plurality of servers so that each of said plurality of 
servers can access the list of events and the corresponding list of servers stored in said 
glooal event registry. 
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5. A method of observing events as recited in clainn 1 wherein sajefglobal 
event registry is distributed across a plurality of servers and wherein said dtirality of 
servers can access said global event registry to retrieve desired information therefrom. 

6. A method of observing events as recited in claim further comprising 
the step of registering for an event by placing an entry into at lefast one of said global 
event registry or said local event registry, said entry compri^ng a server and a 
corresponding event if said entry is placed in said global/6vent registry and said entry 
comprising a local event consumer and a corresponding event if said entry is placed in 
said local event registry. 

7. A method of observing evervts as recited in claim 1 further comprising 
the step of creating a new event type by placing an entry into at least one of said global 
event registry or said locaLevent regis|f7,.said;entry comprising a serverand a 
corresponding new event type if saja entry is placed in said global event registry and 
said entry comprising a local event consumer and a corresponding new event type if 
said entry is placed in said loc3l event registry. 

8. A method^f observing events as recited in claim 1 wherein the notifying 
step further comprisesynotifying a system administrator of the specific event. 

9. A method of observing events as recited in claim 1 wherein the 
recording step comprises recording information regarding the specific events. 

10/ A method of observing events as recited in claim 9 wherein the 
recorded/information is selected from the list comprising: time of occurrence, event 
sourceaype, setting name, event name, class name, perpetrator, originating server, 
attpDute name, attribute value. 
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11. In a distributed computer system (DCS) that provides eventglobalizing 
of at least one event at one server in said DCS to other servers within saio DCS, a 
method of maintaining a record of specific event activity over said DCS comprising: 
storing a global event repository comprising a list of events and a 

corresponding list of servers in order to identif^hich of said servers 

should receive which events; 
storing a local event registry comprising a list c^f events and a 

corresponding list of local event coimimers in order to identify which 

of said local event consumers should receive which events; 
identifying specific events within the li^of events to be monitored for a specific 

purpose; 

monitoring said specific events sfe they occur over said DCS; 
automatically updating the lo^l event registry based upon authorized changes 

to a. given event or Jocal event consumer;. . 
notifying a specific loca/event consumer of the occurrence of said specific 
events; and 

recording a log of;^vent activity involving only said specific events. 



12. A method of observing events as recited in claim 1 1 further comprising 
20 the step of storing ffltering criteria that is used to filter specific events that occur so that 
only notification /f events meeting the stored filtering criteria is sent. 

13/ A method of observing events as recited in claim 12 wherein said stored 
filtering pfiteria specifies at least one event consumer and the filtering criteria 
25 associated with the at least one event consumer. 



14. A method of observing events as recited in claim 1 1 wherein said global 
'event registry is accessible to a plurality of servers so that each of said plurality of 
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servers can access the list of events and the corresponding list of servers/stored in said 
global event registry. / 

15. A nriethod of observing events as recited in clain?T 1 1 wherein said global 
event registry is distributed across a plurality of servers andy^herein said plurality of 
servers can access said global event registry to retrieve desired information therefrom. 

16. A method of observing events as raited in claim 1 1 wherein said 
notifying step further comprises evaluating a serof rules to determine the specific event 
consumer to notify. / 

17. A method of observing^vents as recited in claim 1 1 wherein said 
notifying step further comprises fihiering said specific event to match said specific event 
to an appropriate eventxonsurafer. 

18. A methock^f observing events as recited in claim 1 1 wherein the 
notifying step further comprises notifying a system administrator of the specific event, 

19. A'^method of observing events as recited in claim 11 wherein the 
recording step comprises recording information regarding the specific events. 

/20. A method of observing events as recited in claim 19 wherein the 
recorded information is selected from the list comprising: time of occurrence, event 
source type, setting name, event name, class name, perpetrator, originating server, 
Attribute name, attribute value. 
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21 . In a distributed computer system (DCS) that provides event olobalizing 
of at least one event at one server in said DCS to other servers within sakrDCS, a 
method of maintaining a record of specific event activity over said DCSxomprising: 

storing a global event repository comprising a list of events/and a 

corresponding list of servers in order to identify Wnich of said servers 

should receive which events; / 
storing a local event registry comprising a list or events and a 

corresponding list of local event cormimers in order to identify which 

of said local event consumers simjid receive which events; 
identifying specific events within the lis/of events to be monitored for a specific 

purpose; / 
monitoring said specific events as they occur over said DCS; 
automatically updating the loiral event registry based upon authorized changes 

to a given event op'Iocal event ^consumer;, 
notifying a specific loc^revent consumer of the occurrence of said specific 

events; / 
revoking a specific event that is not authorized; and 
recording a \dg of event activity involving only said specific events. 

22. A method of observing events as recited in claim 21 further comprising 
the step of spring filtering criteria that is used to filter specific events that occur so that 
only notifu^^ation of events meeting the stored filtering criteria is sent. 

/ 23. A method of observing events as recited in claim 22 wherein said stored 
filtering criteria specifies at least one event consumer and the filtering criteria 
associated with the at least one event consumer. 
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24. A method of observing events as recited in ciainn 21 wherein said global 
event registry is accessible to a plurality of servers so that each of said plur^ty of 
servers can access the list of events and the corresponding list of serve];s stored in said 
global event registry. 



25. A method of observing events as recited in cla^ffi 21 wherein said global 
event registry is distributed across a plurality of servers andwherein said plurality of 
servers can access said global event registry to retrieveyoesired information therefrom. 

10 26. A method of observing events as n^ited in claim 21 wherein said 

notifying step further comprises evaluating a sefof rules to determine the specific event 
consumer to notify and which specific event^are unauthorized. 

27. A method.of observing/events as jecitedJn claim 21 wherein said. 
15 notifying step further comprises filtenng said specific event to match said specific event 
to an appropriate event consumefr. 
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28. A method of observing events as recited in claim 21 wherein the 
notifying step further comprises notifying a system administrator of the unauthorized 
specific event. 



29. X method of observing events as recited in claim 21 wherein the 
recording stec/com prises recording information regarding the specific events. 



25 ZO, A method of observing events as recited in claim 29 wherein the 

recorded information is selected from the list comprising: time of occurrence, event 
source type, setting name, event name, class name, perpetrator, originating server, 
Tribute name, attribute value. 
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31 . A distributed computer environment (DCE) system compj^ising: 
a system directory; 

a least one server, coupled to the system directory; 

at least one global event services controller, coupled/fo the system directory, to 
5 globalize at least one event at said at lea^ one server to other servers 

within said DCE, wherein a local even/ ^egistry is stored maintained by 
the at least one global event services controller, the local event 
registry comprising a list of evems and a corresponding list of servers 
in order to identify which of^id servers should receive which events 
10 and a list of events and axorresponding list of local event consumers 

that identify which of jafaid local event consumers should receive which 
local events; and 

a data alert controller, coupled to said at least one global event services 

controller, tc/monitor specific events.as they occur over the DCE,., 
15 notify a specific local event consumer of the occurrence of the specific 

event^ and record a log of event activity involving only said specific:, 
events. 

32. / The DCE system as recited in claim 31 further comprising at least one 
20 filter, assoaated with each specific local event consumer and coupled to the data alert 

controller, to filter specific events using defined filtering criteria so that only notification 
of events meeting the stored filtering criteria is sent. 
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33. The DCE system as recited in claim 32 wherein said stored filtering 
criteria specifies at least one event consumer and the filtering criteria asspciated with 
the at least one event consumer. 

5 34. The DCE system as recited in claim 31 wherein/^aid global event 

registry is accessible to a plurality of servers so that each oVsa\6 plurality of servers can 
access the list of events and the corresponding list of s^ers stored in said global 
event registry. 

10 35. The DCE system as recited iryclaim 31 wherein said global event 

registry is distributed across a plurality of s^ers and wherein said plurality of servers 
can access said global event registry tg/retrieve desired information therefrom. 

36. The DCE systemyds recited, in claim 31'r further comprising a rules- 
15 controller, coupled to -the data/alert controller to evaluate a set of rules4o.determine.the 

specific event consumer to/notify and which specific events are unauthorized-. >. 

37. The DCE system as recited in claim 31 further comprising a registration 
filter, coupled to tlie data alert controller, to filter said specific event to match said 

20 specific event to^n appropriate event consumer. 

38( The DCE system of claim 31 wherein the. data alert controller also 
notifies sr system administrator of the unauthorized specific event. 

25 / 39. The DCE system of claim 31 wherein the log record comprises 
infformation regarding the specific events. 
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40. The DCE system as recited in claim 39 wherein th^nformation is 
selected from the list comprising: time of occurrence, event source type, setting name, 
event name, class name, perpetrator, originating server, aJMribute name, attribute value. 

41 . The DCE system as recited in clair)/31 wherein the global event 
services controller updates the local event regi^fry based upon authorized changes to a 
given event or local event consumer. X 

42. The DCE system a^ecited in claim 31 wherein the data- event 
controller revokes a specific ev^nt that is not authorized. 

43. The DCE system as recited in claim 36 wherein each event consumer 
utiizes the set of rubds to determine what action to take. 
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